Borrowing it
Nothing to install: this file belongs to xsovad06/sova. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/xsovad06/sova/main/.agents/skills/sova-pr/SKILL.mdgit clone --depth 1 https://github.com/xsovad06/sovaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/xsovad06/sova/sova-pr)<a href="https://agentmods.dev/skills/xsovad06/sova/sova-pr"><img src="https://agentmods.dev/badge/skills/xsovad06/sova/sova-pr/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/xsovad06/sova/sova-pr"><img src="https://agentmods.dev/badge/skills/xsovad06/sova/sova-pr.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00023 | $0.07758 |
| Opus 5.5 | $0.00009 | $0.03103 |
| Sonnet 5.5 | $0.00005 | $0.01552 |
| Haiku 4.5 | $0.00002 | $0.00776 |
Grade A, and why
sova-pr scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 389 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Create Pull Request
Create a pull request for the current branch using the project's standard PR template.
Instructions
-
Resolve the base branch and fetch (do not rebase yet: step 3 decides whether rebasing is safe for this PR): Resolve the base branch at runtime rather than assuming
main. Every shell block in this command runs in a fresh shell, so each block that usesBASEre-assigns it first. Fall back to the repo default only whengh pr viewconfirms there is no PR for this branch yet; abort on any other failure (auth, network, API) instead of guessing:BASE=$(gh pr view --json baseRefName --jq .baseRefName 2>&1) || { case "$BASE" in *"no pull requests found"*) BASE=$(gh repo view --json defaultBranchRef --jq .defaultBranchRef.name) ;; *) echo "Unable to resolve the base branch: $BASE" >&2; exit 1 ;; esac; } [ -n "$BASE" ] || { echo "Unable to resolve the base branch" >&2; exit 1; } git fetch origin || { echo "Fetch failed: STOP, origin/$BASE may be stale" >&2; exit 1; } echo "Base branch: $BASE"- Never check out the base branch: in a linked worktree it is usually checked out elsewhere, so
git checkout "$BASE"fails. Rebase onto the remote-tracking ref instead. - Verify the GitHub account:
gh auth statusmust show the account the project configures as its GitHub user (for SOVA projects,sova config get github_userprints it). Otherwise--assignee @mein step 11 assigns the wrong user and later thread writes fail with FORBIDDEN. If it differs, rungh auth switch --user <github_user>.
- Never check out the base branch: in a linked worktree it is usually checked out elsewhere, so
-
Gather branch information. These commands do not need
$BASEand can run in parallel:git status: check for uncommitted changesgit branch --show-current: get current branch namegit diff --stat: summary of uncommitted changesgh pr list --head $(git branch --show-current) --json number,url,state: check if PR already exists
The two commands below need
$BASE, resolved fresh in this shell (same fail-closed resolution as step 1):BASE=$(gh pr view --json baseRefName --jq .baseRefName 2>&1) || { case "$BASE" in *"no pull requests found"*) BASE=$(gh repo view --json defaultBranchRef --jq .defaultBranchRef.name) ;; *) echo "Unable to resolve the base branch: $BASE" >&2; exit 1 ;; esac; } [ -n "$BASE" ] || { echo "Unable to resolve the base branch" >&2; exit 1; } git log "origin/$BASE"..HEAD --oneline git diff "origin/$BASE"...HEAD --stat
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed · +3 lines 060d852a002b
- 5d ago Changed · +66 lines e20dca41ba82
- 6d ago Changed · +50 lines c9f7fe651909
- 9d ago Changed · +14 lines 0da96c0f4e98
- 14d ago Changed · +8 lines c60bb6624957
- 16d ago Changed · +48 lines a6314f322181
- 19d ago Changed · +1 lines 6cbe88b4b777
- 21d ago Changed f7a00d36328f
- 22d ago First seen · 199 lines · 23 tokens per session scan A 060fd8fcdab2
sova-pr is a skill published in the GitHub repository xsovad06/sova (2 stars, last pushed today), licensed Apache-2.0. It adds 23 tokens to every session and 7,758 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-08.
Other skills, from other repositories
autofix-pr
Watch a pull request and fix it from a worktree of its own - CI failures, review feedback from trusted authors and merge conflicts are fixed, pushed to the PR branch and answered on the PR under the user's git and gh identity. Usage - /autofix-pr [ | ] [--once] [--every ] [--no-reply] [--yes] [instructions]…
gh-find-prs
Survey open Codewhale PRs and triage each for mergeability and disposition against the real landing branch.
hunk-release
Prepares, publishes, verifies, and curates Hunk releases. Use for release metadata, benchmarks, tags, publishing, release videos, backports, or recovery.
git
Git and code hosting platform management — GitHub, GitLab, Codeberg, Forgejo. Zero barrier — install x-cmd and manage repos from the terminal. Use for "git", "github", "gitlab", "repo", "pull request", "code hosting".
vhs-e2e-gif
Record a test run, a TUI session, or any terminal command as a GIF with VHS and attach it to a GitHub PR as a release-hosted asset, never a repo commit. Use when asked to record an e2e run, demo a fix on a PR, attach a GIF or screen recording to a pull request, show a test passing visually, or produce a terminal…
agent-debug-ci
Investigate failed scheduled or nightly GitHub Actions runs on the default branch, determine whether the failure is reproducible and repository-owned, implement the smallest evidence-backed fix, validate it, and open a pull request. Use when a failed nightly CI event starts an agent, or when the standard CI or…